Canon Basic scripting (DIGIC 8, DIGIC X models)

Started by srsa, September 03, 2020, 01:11:27 AM

Previous topic - Next topic

0 Members and 2 Guests are viewing this topic.

yourboylloyd

Join the ML discord! https://discord.gg/H7h6rfq

srsa

Canon Basic script for running a small binary. The five function addresses listed at start are required to be correct. The initial values are for sx740 1.0.1
The binary is loaded in uncached RAM and executed as-is. The firmware always applies cache and branch predictor related routines on code loaded to RAM, so there is a possibility that this approach is not fully reliable.' firmware function addresses with thumb bit
dim a_fio_readf=0xE0520E8B ' FIO_ReadFile
dim a_fio_writef=0xE0521027 ' FIO_WriteFile
dim a_fio_removf=0xE0520DF1 ' FIO_RemoveFile (newer cams have an equivalent RemoveFile eventproc)
dim a_umalloc=0xE053A0B1 ' AllocateUncacheableMemory
dim a_ufree=0xE053A0E5 ' used to free AllocateUncacheableMemory allocations (not named)

dim cpuinf_binary="B:/CPUINFO.BIN"
dim cpuinf_data="B:/CPUINFO.DAT"

private sub reg_funcs1()
    ExportToEventProcedure("FIO_ReadFile",a_fio_readf|1)
    ExportToEventProcedure("FIO_WriteFile",a_fio_writef|1)
    ExportToEventProcedure("FIO_RemoveFile",a_fio_removf|1)
    ExportToEventProcedure("umalloc",a_umalloc|1)
    ExportToEventProcedure("ufree",a_ufree|1)
end sub

private sub Initialize()
    reg_funcs1()
    buf = umalloc(0x1000)
    if buf=0 then
        exit sub
    end if
    bufo = umalloc(0x1000)
    if bufo=0 then
        ufree(buf)
        exit sub
    end if
    memset(bufo,0,0x1000)
    f = OpenFileRD(cpuinf_binary)
    FIO_ReadFile(f,buf,0x1000)
    CloseFile(f)
    ExportToEventProcedure("cpuinfo",buf|1)
    cpuinfo(bufo)
    FIO_RemoveFile(cpuinf_data)
    f = OpenFileCREAT(cpuinf_data)
    CloseFile(f)
    f = OpenFileWR(cpuinf_data)
    FIO_WriteFile(f,bufo,0x1000)
    CloseFile(f)
    ufree(bufo)
    ufree(buf)
end sub

Assembly source for the current CPUINFO code from here. It now supports ARMv7 VMSA (such as Cortex A9) CPUs.

@ compile with:
@ arm-none-eabi-gcc -Wl,-N,-Ttext,0x800000 -nostdlib -march=armv7 -mthumb cpuinfo.s -o cpuinfo.elf
@ and extract the needed bytes from the binary:
@ arm-none-eabi-objcopy -O binary cpuinfo.elf cpuinfo.bin
@ toolchain: [url]https://launchpad.net/gcc-arm-embedded[/url]
@ 0x00800000 is an arbitrary address, code is position independent anyway

.macro NHSTUB name addr
.globl _\name
.weak _\name
_\name:
ldr.w pc, _\addr
_\addr:
.long \addr
.endm

.globl _start
.org 0
_start:
.text
@ force thumb
.code 16
@ allow new instructions (ldr.w)
.syntax unified

MRC    p15, 0, R1,c0,c0 @ ident
STR    R1, [R0]

MRC    p15, 0, R1,c0,c0,1 @ CTR, cache
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c0,2 @ TCMTR, TCM
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c0,3 @ TLBTR
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c2,c0,2 @ TTBCR
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c2,c0,0 @ TTBR0
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c2,c0,1 @ TTBR1
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c0,5 @ MPIDR
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c0,6 @ REVIDR
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c1,0 @ ID_PFR0
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c1,1 @ ID_PFR1
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c1,2 @ ID_DFR0
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c1,3 @ ID_AFR0
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c1,4 @ ID_MMFR0
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c1,5 @ ID_MMFR1
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c1,6 @ ID_MMFR2
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c1,7 @ ID_MMFR3
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c2,0 @ ID_ISAR0
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c2,1 @ ID_ISAR1
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c2,2 @ ID_ISAR2
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c2,3 @ ID_ISAR3
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c2,4 @ ID_ISAR4
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c0,c2,5 @ ID_ISAR5
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 1, R1,c0,c0,1 @ CLIDR
ADD    R0, R0, #4
STR    R1, [R0]

MOV    R1, #0
MCR    p15, 2, R1,c0,c0,0 @ CSSELR (data cache, level0)

MRC    p15, 1, R1,c0,c0,0 @ CCSIDR (the currently selected one)
ADD    R0, R0, #4
STR    R1, [R0]

MOV    R1, #1
MCR    p15, 2, R1,c0,c0,0 @ CSSELR (inst cache, level0)

MRC    p15, 1, R1,c0,c0,0 @ CCSIDR (the currently selected one)
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c1,c0,0 @ SCTLR
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c1,c0,1 @ ACTLR
ADD    R0, R0, #4
STR    R1, [R0]

@#ifndef CONFIG_QEMU
MRC    p15, 0, R1,c15,c0,0 @ ACTLR2
ADD    R0, R0, #4
STR    R1, [R0]
@#endif

MRC    p15, 0, R1,c1,c0,2 @ CPACR
ADD    R0, R0, #4
STR    R1, [R0]

@"MRC    p15, 0, R1,c9,c1,1 @ ATCM region reg, Cortex R4
@"ADD    R0, R0, #4
@"STR    R1, [R0]

@"MRC    p15, 0, R1,c9,c1,0 @ BTCM region reg, Cortex R4
@"ADD    R0, R0, #4
@"STR    R1, [R0]

MRC    p15, 0, R1,c1,c1,2 @ NSACR
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c3,c0,0 @ DACR
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p14, 0, R1,c0,c0,0 @ DBGDIDR
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p14, 0, R1,c1,c0,0 @ DBGDRAR
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p14, 0, R1,c2,c0,0 @ DBGDSAR
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p14, 0, R1,c0,c1,0 @ DBGDSCR
ADD    R0, R0, #4
STR    R1, [R0]

@".word  0xEEF01A10 @"VMRS   R1, FPSID @ Floating Point System ID register
@"ADD    R0, R0, #4
@"STR    R1, [R0]

@".word  0xEEF71A10 @"VMRS   R1, MVFR0 @ Media and VFP Feature Register 0
@"ADD    R0, R0, #4
@"STR    R1, [R0]

@".word  0xEEF61A10 @"VMRS   R1, MVFR1 @ Media and VFP Feature Register 1
@"ADD    R0, R0, #4
@"STR    R1, [R0]

MRC    p15, 4, R1,c15,c0,0 @ config base addr reg (Cortex A9)
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c11,c0,0 @ PLEIDR (Cortex A9)
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c10,c0,0 @ TLB lockdown reg (Cortex A9)
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c10,c2,0 @ PRRR (Cortex A9)
ADD    R0, R0, #4
STR    R1, [R0]

MRC    p15, 0, R1,c10,c2,1 @ NMRR (Cortex A9)
ADD    R0, R0, #4
STR    R1, [R0]

BX     LR
I already executed this on my camera and found no big differences from DIGIC 7.
Running this on R5 or R6 would be more interesting.

Evaluating the CPUINFO.DAT binary is currently only possible on a D6-D7 CHDK cam with patched CPUINFO module. Porting the evaluator to "PC" would solve that.
Index: modules/cpuinfo.c
===================================================================
--- modules/cpuinfo.c (revision 5564)
+++ modules/cpuinfo.c (working copy)
@@ -66,17 +66,36 @@
     char buf[100];
     char *p;
#ifdef THUMB_FW
+    int pmsa = 0;
     struct cpuinfo_word_desc_s *cpuinfo_desc;
-    if (cpu_is_vmsa()) {
-        FILE *f=fopen("A/MMU_MAP.CSV", "wb");
-        memmapping_vmsa(f);
-        cpuinfo_get_info_vmsa(cpuinfo);
+
+    finfo = fopen("A/CPUI_V7V.DAT","rb");
+    if (!finfo) {
+        finfo = fopen("A/CPUI_V7P.DAT","rb");
+        pmsa = 1;
+    }
+    if (!finfo) {
+        pmsa = !cpu_is_vmsa();
+        if (cpu_is_vmsa()) {
+            FILE *f=fopen("A/MMU_MAP.CSV", "wb");
+            memmapping_vmsa(f);
+            cpuinfo_get_info_vmsa(cpuinfo);
+        }
+        else {
+            cpuinfo_get_info_pmsa(cpuinfo);
+        }
+    }
+    else {
+        fread(cpuinfo, 4, NUM_CPUINFO_WORDS, finfo);
+        fclose(finfo);
+    }
+    if (!pmsa) {
         cpuinfo_desc = (struct cpuinfo_word_desc_s*) cpuinfo_desc_vmsa;
     }
     else {
-        cpuinfo_get_info_pmsa(cpuinfo);
         cpuinfo_desc = (struct cpuinfo_word_desc_s*) cpuinfo_desc_pmsa;
     }
+
#else
     cpuinfo_get_info(cpuinfo);
#endif

names_are_hard

Thanks, this is quite interesting.  Are you aware of Scout debugger?

https://github.com/CheckPointSW/Scout

In theory this can be loaded into Canon cams and act as a network debugger.  I played with it briefly but couldn't work out how to build it.

srsa

Quote from: names_are_hard on September 10, 2020, 03:17:51 AM
Thanks, this is quite interesting.  Are you aware of Scout debugger?

https://github.com/CheckPointSW/Scout
It was mentioned in their ransomware article. Never tried to use it.
QuoteIn theory this can be loaded into Canon cams and act as a network debugger.
They mention it worked, but the subject was a DIGIC 6 camera. DIGIC 7 and later has a separate core for networking. The firmware refers to it as "Lime". That CPU is not ARM, it's Xtensa. And that architecture is not supported by Scout.

jo.meatloaf

Quote from: Walter Schulz on September 04, 2020, 05:14:00 PM
Maybe subject needs to be chanced a bit. My 250D/200D Mark II/Rebel SL3/Kiss X10 does execute Canon Basic script and produces ROM.TXT. Zero Bytes but it is written nevertheless!
Correction: 2 129 920 Bytes
Want to have a look? -> PN

Any hints what is needed to dump valid bits and bytes?

90D, M6 II, G7X III: Users around? Making a script card is easy!
If there are troubles I promise to assist via Teamviewer (or else).

hi i have, m6 mkii 1.1.0 , i need ML)))

Walter Schulz

Quote from: jo.meatloaf on September 11, 2020, 01:01:36 PM
hi i have, m6 mkii 1.1.0 , i need ML)))


Fine! Start coding and repost with an early beta. Est. 2023.

names_are_hard

I found stubs for R6, got cpuinfo dumper built.  Thanks to @yourboylloyd who is a brave tester, we can confirm it works.  I'm now porting the code to linux so I can view the results.

nikfreak

[size=8pt]70D.112 & 100D.101[/size]

coon

I found stubs for RP and dumped cpuinfo on my cam. I will publish the results once the parser of names_are_hard is ported.

RP stubs for firmware 1.5.0 are:


dim a_fio_readf=0xE0584C07 ' FIO_ReadFile
dim a_fio_writef=0xE0584D9F ' FIO_WriteFile
dim a_fio_removf=0xE0584B6F ' FIO_RemoveFile (newer cams have an equivalent RemoveFile eventproc)
dim a_umalloc=0xE0594A8D ' AllocateUncacheableMemory
dim a_ufree=0xE0594AC1 ' used to free AllocateUncacheableMemory allocations (not named)
EOS RP

names_are_hard

I have a crude early port of the cpuinfo parser.  There's some conditional stuff around VMSA, PMSA and v5 / v7 that for now I ignore.  I don't have a good way to check if the output is sensible.  Here's a truncated example:

./build/parser cpuinfo.rp.dat && cat CPUINFO.TXT

ID         0x414FC091
  Revision             0x1 1
  Part                 0xC09 3081
  ARM Arch             0xF 15
  Variant              0x4 4
  Implementor          0x41 65
Cache type 0x83338003
  Icache min words/line 0x3 3 [8]
  (zero)               0x0 0
  L1 Icache policy     0x2 2
  Dcache min words/line 0x3 3 [8]
  Exclusives Reservation Granule 0x3 3 [8]
  Cache Writeback Granule 0x3 3 [8]
  (zero)               0x0 0
  (register format)    0x4 4
TCM type   0x00000000
  (raw value)          0x0 0
TLB type   0x00000404
  TLB                  0x0 0 [Unified TLB]
  TLB entries          0x2 2 [256]
  -                    0x0 0
  Lockable unified or data entries 0x4 4
  Lockable instruction entries 0x0 0
  (zero)               0x0 0


Does that look obviously wrong to anybody?

@srsa - can I ignore memmapping_vmsa(), or is it important to get that working?

srsa

Quote from: names_are_hard on September 14, 2020, 07:27:49 AM
I don't have a good way to check if the output is sensible.
The output is correct. The parsed text can be added to this thread.

Quote@srsa - can I ignore memmapping_vmsa(), or is it important to get that working?
That is only usable on camera, and only makes sense if one is trying to make changes to the memory translation.

I ended up hacking standalone support into the cpuinfo source (cpuinfo.c and cpuinfo_v7.c from here). Patch below. The patched 2 files can be compiled with
gcc -m32 -o cpuinfo.exe -DCPUINFO_STANDALONE cpuinfo.c32-bit only due to arch-dependent types in source.
Index: modules/cpuinfo.c
===================================================================
--- modules/cpuinfo.c (revision 5570)
+++ modules/cpuinfo.c (working copy)
@@ -1,3 +1,5 @@
+#ifndef CPUINFO_STANDALONE
+
#include "stdlib.h"
#include "gui_mbox.h"
#include "gui.h"
@@ -4,6 +6,24 @@
#include "gui_lang.h"
#include "lang.h"

+#else // CPUINFO_STANDALONE
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#define THUMB_FW 1
+
+const char *fni;
+const char *fno;
+static int is_vmsa = 1;
+
+int cpu_is_vmsa() {
+    return is_vmsa;
+}
+
+#endif // CPUINFO_STANDALONE
+
struct cpuinfo_bitfield_desc_s {
     unsigned bits;
     const char *name;
@@ -67,6 +87,7 @@
     char *p;
#ifdef THUMB_FW
     struct cpuinfo_word_desc_s *cpuinfo_desc;
+#ifndef CPUINFO_STANDALONE
     if (cpu_is_vmsa()) {
         FILE *f=fopen("A/MMU_MAP.CSV", "wb");
         memmapping_vmsa(f);
@@ -77,10 +98,36 @@
         cpuinfo_get_info_pmsa(cpuinfo);
         cpuinfo_desc = (struct cpuinfo_word_desc_s*) cpuinfo_desc_pmsa;
     }
+#endif // CPUINFO_STANDALONE
+
+#else // THUMB_FW
+    cpuinfo_get_info(cpuinfo);
+#endif // THUMB_FW
+
+#ifndef CPUINFO_STANDALONE
+    finfo=fopen("A/CPUINFO.TXT", "wb");
#else
-    cpuinfo_get_info(cpuinfo);
+    finfo = fopen(fni,"rb");
+    if (!finfo) {
+        fprintf(stderr, "Failed to open input file\n\n");
+        return;
+    }
+    else {
+        fread(cpuinfo, 4, NUM_CPUINFO_WORDS, finfo);
+        fclose(finfo);
+    }
+    if (cpu_is_vmsa()) {
+        cpuinfo_desc = (struct cpuinfo_word_desc_s*) cpuinfo_desc_vmsa;
+    }
+    else {
+        cpuinfo_desc = (struct cpuinfo_word_desc_s*) cpuinfo_desc_pmsa;
+    }
+    finfo=fopen(fno, "wb");
+    if (!finfo) {
+        fprintf(stderr, "Failed to open output file\n\n");
+        return;
+    }
#endif
-    finfo=fopen("A/CPUINFO.TXT", "wb");
     for(i = 0; cpuinfo_desc[i].name; i++) {
         wordval = cpuinfo[i];
         sprintf(buf,"%-10s 0x%08X\n",cpuinfo_desc[i].name,wordval);
@@ -88,7 +135,7 @@
         for(j=0; cpuinfo_desc[i].fields[j].name; j++) {
             p=buf;
             bits = cpuinfo_desc[i].fields[j].bits;
-            mask = ~(0xFFFFFFFF << bits);
+            mask = (bits==32) ? 0xffffffff : ~(0xFFFFFFFF << bits);
             fieldval = wordval & mask;
             p+=sprintf(p,"  %-20s 0x%X %d",cpuinfo_desc[i].fields[j].name,fieldval,fieldval);
             if(cpuinfo_desc[i].fields[j].desc_fn) {
@@ -100,10 +147,14 @@
         }
     }
     fclose(finfo);
+#ifndef CPUINFO_STANDALONE
     sprintf(buf, lang_str(LANG_CPUINFO_WROTE), "A/CPUINFO.TXT");
     gui_mbox_init(LANG_MENU_DEBUG_CPU_INFO,(int)buf,MBOX_FUNC_RESTORE|MBOX_TEXT_CENTER, cpuinfo_finish);
+#endif // CPUINFO_STANDALONE
}

+#ifndef CPUINFO_STANDALONE
+
int basic_module_init() {
     cpuinfo_write_file();
     return 1;
@@ -136,3 +187,25 @@

/*************** END OF AUXILARY PART *******************/

+#else // CPUINFO_STANDALONE
+
+char *usage = "\nUsage: %s <cpuinfo.dat> <output file> [-p]\n\n";
+
+
+int main(int ac, const char **av) {
+
+    if (ac < 3) {
+        fprintf(stderr, usage, av[0]);
+        exit(0);
+    }
+    else if (ac > 3) {
+        if (strcmp(av[3], "-p") == 0) {
+            is_vmsa = 0;
+        }
+    }
+    fni = av[1];
+    fno = av[2];
+    cpuinfo_write_file();
+}
+
+#endif // CPUINFO_STANDALONE
Index: modules/cpuinfo_v7.c
===================================================================
--- modules/cpuinfo_v7.c (revision 5570)
+++ modules/cpuinfo_v7.c (working copy)
@@ -535,6 +535,7 @@
     {}
};

+#ifndef CPUINFO_STANDALONE

void __attribute__((naked,noinline)) cpuinfo_get_info_pmsa(unsigned *results) {
     asm (
@@ -809,6 +810,8 @@
     );
}

+#endif // CPUINFO_STANDALONE
+
static const char * tlb_unified(unsigned val) {
     switch(val) {
         case 0: return "Unified TLB";
@@ -1007,6 +1010,8 @@
     {}
};

+#ifndef CPUINFO_STANDALONE
+
void __attribute__((naked,noinline)) cpuinfo_get_info_vmsa(unsigned *results) {
     asm (
         ".syntax unified\n"
@@ -1512,4 +1517,6 @@
     fclose(f);
}

+#endif // CPUINFO_STANDALONE

+

names_are_hard

Great!  Added R6 and RP to thread.

I stole your bit twiddling fix and made a repo with my standalone tool.  Tested on Linux, should be portable with minimal changes if anyone needs it.
https://github.com/reticulatedpines/cpuinfo_linux

Yours and mine produce identical output for R6 and RP.

WeakestLinkForNow

So people are already working on the R6 with ML and skipping the M50 altogether?

yourboylloyd

A lot of work has been done on the M50, but there are no active developers working on the camera. If you have coding experience please help on the m50's development.
Join the ML discord! https://discord.gg/H7h6rfq

b

Quote from: yourboylloyd on September 14, 2020, 10:40:05 PM
A lot of work has been done on the M50, but there are no active developers working on the camera. If you have coding experience please help on the m50's development.
I'd personally like to help, but I don't know where to start, as I don't know all that much about the way the firmware works. Could I ask if there are any relatively low-hanging fruit regarding the M50 that I could try and pick at?

Walter Schulz

Quote from: b on September 15, 2020, 01:59:42 AM
I'd personally like to help, but I don't know where to start, as I don't know all that much about the way the firmware works. Could I ask if there are any relatively low-hanging fruit regarding the M50 that I could try and pick at?

First question: Are you willing to put several hundred hours of work into it?

b

Quote from: Walter Schulz on September 15, 2020, 06:42:15 AM
First question: Are you willing to put several hundred hours of work into it?
I'm certainly more than willing to try. I'm aware of the amount of work necessary for this sort of thing, and unfortunately right now I don't really have much else to put hundreds of hours of work into...

I'm not about to give a resume here, both because I don't want to dox myself and because I don't feel like trying to convince anyone that I've got experience hacking hardware. But I can assure you I do, and I've been needing an excuse to learn ARM/thumb assembly anyway.

coon

Quote from: Walter Schulz on September 15, 2020, 06:42:15 AM
First question: Are you willing to put several hundred hours of work into it?

If so, feel free to join us on our unofficial discord server: https://discord.gg/uaY8akC
EOS RP

Walter Schulz

Quote from: b on September 15, 2020, 10:00:40 PM
unfortunately right now I don't really have much else to put hundreds of hours of work into...

Sorry to read that!
Welcome on board and good luck (both ways!)

c_joerg

srsa posted some specific code here that can be used to get some interesting information out of the camera.
https://chdk.setepontos.com/index.php?topic=13943.msg144153#msg144153

private sub Initialize()
    System.Create()
    CamInfo_Debug(1)
end sub


The Canon Basic Code creates a CameraInfo.xml file.
The file contains information such as TotalShoot, TotalRunningTime, ErrorList ...
I would be interested in a CameraInfo.xml from an R5 and R6, especially one that has already crashed.

A CameraInfo.xml of my M100 is here (renamed to txt).
https://chdk.setepontos.com/index.php?topic=13943.msg144154#msg144154




EOS R

chris_overseas

Quote from: c_joerg on September 18, 2020, 07:37:15 AM
I would be interested in a CameraInfo.xml from an R5 and R6, especially one that has already crashed.

Here's the CameraInfo.xml from my R5 (serial number removed):
<?xml version="1.0"?><Canon><CameraInfo><Serial>xxxxxxxxxxxx</Serial><FirmwareVer><Internal>0.4.0.5</Internal><Major>1.1.0</Major></FirmwareVer><ErrorList><Kind><ID>E70</ID><Count>1</Count><ErrorLog><BatTemperature>max:0 min:0</BatTemperature><FirstOccurTime>2020.09.06 17:49:38</FirstOccurTime><LastOccurTime>2020.09.06 17:49:38</LastOccurTime><Log><DateTime>2020.09.06 17:49:38</DateTime><Reason>DS-EID:101</Reason><BatTemperature>0</BatTemperature><LensID>000001eb</LensID><ReleaseCount>234</ReleaseCount></Log></ErrorLog></Kind></ErrorList><TotalShoot>3289</TotalShoot><TotalShutter>3</TotalShutter><PowerOnCount>537</PowerOnCount><TotalRunningTime>83180</TotalRunningTime></CameraInfo></Canon>
EOS R5 1.1.0 | Canon 16-35mm f4.0L | Tamron SP 24-70mm f/2.8 Di VC USD G2 | Canon 70-200mm f2.8L IS II | Canon 100-400mm f4.5-5.6L II | Canon 800mm f5.6L | Canon 100mm f2.8L macro | Sigma 14mm f/1.8 DG HSM Art | Yongnuo YN600EX-RT II

c_joerg

Thanks, looks like your camera was crashed before...
I'm wondering about the BatTemperature = 0.
Do you use external power supply?

And on R5 is a TotalShoot and TotalShutter count...
EOS R

yourboylloyd

Ran on my R6:
<?xml version="1.0"?><Canon><CameraInfo><Serial>XXXXXXXXXXXX</Serial><FirmwareVer><Internal>0.4.0.5</Internal><Major>1.1.0</Major></FirmwareVer><ErrorList><Kind><ID>E01</ID><Count>2</Count><ErrorLog><BatTemperature>max:0 min:0</BatTemperature><FirstOccurTime>2020.09.17 02:08:57</FirstOccurTime><LastOccurTime>2020.09.17 02:09:15</LastOccurTime><Log><DateTime>2020.09.17 02:09:15</DateTime><Reason>DS-EID:068</Reason><BatTemperature>0</BatTemperature><LensID>0000bc95</LensID><ReleaseCount>528</ReleaseCount></Log><Log><DateTime>2020.09.17 02:08:57</DateTime><Reason>DS-EID:068</Reason><BatTemperature>0</BatTemperature><LensID>0000bc95</LensID><ReleaseCount>527</ReleaseCount></Log></ErrorLog></Kind><Kind><ID>E70</ID><Count>4</Count><ErrorLog><BatTemperature>max:0 min:0</BatTemperature><FirstOccurTime>2020.09.17 13:12:17</FirstOccurTime><LastOccurTime>2020.09.20 12:55:27</LastOccurTime><Log><DateTime>2020.09.20 12:55:27</DateTime><Reason>DS-EID:101</Reason><BatTemperature>0</BatTemperature><LensID>00000000</LensID><ReleaseCount>1171</ReleaseCount></Log><Log><DateTime>2020.09.20 12:51:18</DateTime><Reason>DS-EID:101</Reason><BatTemperature>0</BatTemperature><LensID>00000000</LensID><ReleaseCount>1171</ReleaseCount></Log><Log><DateTime>2020.09.17 13:30:36</DateTime><Reason>DS-EID:101</Reason><BatTemperature>0</BatTemperature><LensID>0000bca9</LensID><ReleaseCount>561</ReleaseCount></Log><Log><DateTime>2020.09.17 13:12:17</DateTime><Reason>DS-EID:101</Reason><BatTemperature>0</BatTemperature><LensID>0000bca9</LensID><ReleaseCount>561</ReleaseCount></Log></ErrorLog></Kind><Kind><ID>E255</ID><Count>2</Count><ErrorLog><BatTemperature>max:0 min:0</BatTemperature><FirstOccurTime>2020.09.20 12:51:15</FirstOccurTime><LastOccurTime>2020.09.20 12:51:15</LastOccurTime><Log><DateTime>2020.09.20 12:51:15</DateTime><Reason>DS-EID:028</Reason><BatTemperature>0</BatTemperature><LensID>00000000</LensID><ReleaseCount>1171</ReleaseCount></Log><Log><DateTime>2020.09.20 12:51:15</DateTime><Reason>DS-EID:028</Reason><BatTemperature>0</BatTemperature><LensID>00000000</LensID><ReleaseCount>1171</ReleaseCount></Log></ErrorLog></Kind></ErrorList><TotalShoot>1471</TotalShoot><TotalShutter>305</TotalShutter><PowerOnCount>311</PowerOnCount><TotalRunningTime>63758</TotalRunningTime></CameraInfo></Canon>

Ran on m50:
<?xml version="1.0"?><Canon><CameraInfo><Serial>XXXXXXXXXX</Serial><FirmwareVer><Internal>0.7.0.0</Internal><Major>1.0.2</Major></FirmwareVer><ErrorList></ErrorList><TotalShoot>1078</TotalShoot><TotalShutter>1078</TotalShutter><TotalSW2>1229</TotalSW2><TotalSW2Long>0</TotalSW2Long><PowerOnCount>690</PowerOnCount><TotalRunningTime>225948</TotalRunningTime></CameraInfo></Canon>

Quote from: c_joerg on September 18, 2020, 08:13:47 AM
And on R5 is a TotalShoot and TotalShutter count...
It's probably because there is a mechanical shutter and electronic shutter.
Join the ML discord! https://discord.gg/H7h6rfq

c_joerg

Quote from: yourboylloyd on September 18, 2020, 08:22:01 AM
It's probably because there is a mechanical shutter and electronic shutter.

But it is also on R5

M50 has also an TotalSW2 count...
EOS R

coon

RP:


<?xml version="1.0"?>
<Canon>
    <CameraInfo>
        <Serial>xxxxxxxxxxxx</Serial>
        <FirmwareVer>
            <Internal>0.3.8.7</Internal>
            <Major>1.5.0</Major>
        </FirmwareVer>
        <ErrorList></ErrorList>
        <TotalShoot>1780</TotalShoot>
        <TotalShutter>1086948659</TotalShutter>
        <PowerOnCount>229</PowerOnCount>
        <TotalRunningTime>148394</TotalRunningTime>
    </CameraInfo>
</Canon>


Shutter count seems to be invalid.
EOS RP